The fundamental underlying assumptions of our approach lie in the fact that tensor-state statistics at each graph node from all activations with training images per class can gain us insights into a mathematical function defining the mapping between class-defining training images and class labels. The tensor-state statistics are quantified based on capacity versus utilization metrics. Such metrics capture the concept of a successful defense against backdoor attacks by graph pruning as reported by Liu et al. [1]} and are assumed to reveal a presence or absence of hidden classes (triggers or backdoor attacks). Although symbolic representations of subgraphs are still under investigation by Olah et al. [2]}, [3]}, we also assume that the utilization-based characterization of subgraphs may have a relationship with symbolic descriptions of image parts (e.g., subgraphs encode a traffic sign shape) and hence presence or absence of trojans can be detected by finding patterns in utilization-based color-coded graphs and subgraphs.
